A method for constructing a virtual communication network based on quantum key association

Abstract

The present application discloses a method for constructing a virtual communication network based on quantum key association, the method comprising: the 1X client initiates a communication request to the first access base station; the first boundary base station addresses the second boundary base station; the first boundary base station negotiates keys with the second boundary base station, determines that the communication key in this communication process is QRN‑XY, the encryption and decryption key is key‑XY and issues them to the 1X client and the 2Y client respectively; the first boundary base station generates the XYth virtual communication network based on the communication key QRN‑XY; in the XYth virtual communication network, the 1X client uses the encryption and decryption key key‑XY to encrypt the communication content and communicate with the 2Y client, and after the communication is completed, the first boundary base station releases the XYth virtual communication network. The present invention constructs a virtual communication network based on the same communication key, ensures the normal communication, and effectively ensures the security of the clients of both communicating parties in this communication process by filtering the third-party clients through the access base station.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a method for constructing a virtual communication network based on quantum key association. Background Art

[0002] The rapid development of data communications has brought convenience to people's lives, but it has also brought about data confidentiality issues. Cases of illegal information interception and database theft often occur. For example, the emergence of online banking has enabled people to perform financial operations such as transfers online, but it has also brought about the problem of bank password theft, causing financial losses to account holders.

[0003] When a client accesses a communication network, the communication network will assign an IP address to the client as the communication address of the client in the communication network. When the client accesses the communication network, the terminal is accessible to the public, and the IP address information will be exposed to the Internet during the communication between the client and other clients in the communication network. If an information thief learns the IP address, he can establish a connection with the client based on the one-to-one correspondence between the IP address and the client, and carry out illegal data acquisition and other activities.

[0004] The reason for the above problems is that the network is open, and information thieves can use the network address to locate the client and invade. How to ensure the security of the client in the network environment while ensuring normal communication of the client is a technical problem that urgently needs to be solved. Summary of the invention

[0005] Purpose of the invention: The purpose of the present invention is to provide a method for constructing a virtual communication network based on quantum key association.

[0006] Technical solution: The present invention provides a method for constructing a virtual communication network based on quantum key association. The participants of the method include a first client group, a first access base station, a first boundary base station in the communication network, and a second client group, a second boundary base station, and a second access base station to be communicated with the first client group. The number of clients in the first client group and the second client group is at least one. The clients in the first client group are all connected to the first access base station, and the first access base station is connected to the first boundary base station for communication. The clients in the second client group are all connected to the second access base station, and the second access base station is connected to the second boundary base station for communication. The method comprises the following steps:

[0007] Step 1: The 1X client in the first client group initiates a first communication request req1 to the first access base station;

[0008] Step 2: The first access base station generates a second communication request req2 based on the first communication request req1, and sends the second communication request req2 to the first border base station, and the first border base station addresses the second border base station according to the second communication request req2;

[0009] Step 3: The first border base station negotiates a key with the second border base station, and determines that the communication key in this communication process is QRN-XY, and the encryption and decryption key is key-XY;

[0010] Step 4: The first border base station feeds back the communication key QRN-XY and the encryption and decryption key key-XY to the first access base station, and the first access base station issues the communication key QRN-XY and the encryption and decryption key key-XY to the 1Xth client in a quantum secure manner; at the same time, the second border base station feeds back the communication key QRN-XY and the encryption and decryption key key-XY to the second access base station, and the second access base station issues the communication key QRN-XY and the encryption and decryption key key-XY to the 2Yth client in the second client group in a quantum secure manner;

[0011] Step 5: The first border base station generates a XYth virtual communication network based on the communication key QRN-XY based on the second communication request req2 and the communication key QRN-XY;

[0012] Step 6: In the XY virtual communication network, the 1X client uses the encryption and decryption key key-XY to encrypt the communication content and communicate with the 2Y client. After the communication is completed, the first border base station releases the XY virtual communication network.

[0013] As an improvement of the present invention, in the step 1, the first communication request req1 includes the IP address information of the second boundary base station to which the client to be communicated with the 1X client is connected and the IP address information of the client to be communicated with the 1X client, and also includes information instructing the first access base station to issue a communication key and an encryption and decryption key to the 1X client; wherein the client to be communicated with the 1X client is the 2Y client in the second client group; the communication key is used to associate the 1X client and the 2Y client participating in this communication, and the encryption and decryption key is used to perform encryption and decryption operations on the communication content.

[0014] As an improvement of the present invention, in step 2, the second communication request req2 includes information instructing the first border base station to address the second border base station based on the IP address information of the second border base station.

[0015] As an improvement of the present invention, in step 4, the specific process of the quantum security method used by the first access base station to issue the communication key QRN-XY and the encryption and decryption key key-XY to the 1X client is as follows:

[0016] 4-1: The first access base station concatenates the communication key QRN-XY and the encryption and decryption key key-XY into a transmission file doc=(QRN-XY, key-XY);

[0017] 4-2: The first access base station obtains a set of keys u1 from the local key pool as random numbers, which are used to generate an irreducible polynomial p1(x). After obtaining the irreducible polynomial, the character string consisting of the coefficients of each term except the highest term in the irreducible polynomial p1(x) is recorded as str1;

[0018] 4-3: The first access base station negotiates a set of keys (u2, u3) with the 1X client, and generates a hash function h based on the irreducible polynomial p1(x) and the key u2 p1,u2 , using the hash function h p1,u2 Calculate the first hash value h of the transferred file doc p1,u2 (doc), encrypt the first hash value h using key u3 p1,u2 (doc), transfer file doc, and string str1, get the first ciphertext m=[h p1,u2 (doc),doc,str1]⊕u3;

[0019] 4-4: The first access base station sends the first ciphertext m to the 1X client, and the 1X client verifies the integrity of the received transmission file doc:

[0020] The 1X client uses the negotiated key u3 to perform a decryption operation and obtains the decrypted second hash value h′ p1,u2 (doc), transmission file doc′, and string str1′, use the coefficients of each item of the polynomial except the highest item of each bit of the decrypted string str1′ to generate an irreducible polynomial p′1(x) with the highest item coefficient as 1, and generate a hash function h″ based on the irreducible polynomial p′1(x) and the negotiated key u2 p1,u2 , using the hash function h″ p1,u2 Calculate the third hash value h″ of the transmission file doc′ p1,u2 (doc′); compare the third hash value h″ p1,u2 (doc′) and the second hash value h′ p1,u2 (doc) Whether it is consistent, if it is consistent, the integrity verification passes, if it is inconsistent, the integrity verification fails;

[0021] 4-5: In response to the integrity verification of the transmission file doc being successful, the 1X client accepts the transmission file doc′, and parses the transmission file doc′ to obtain the communication key QRN-XY and the encryption and decryption key key-XY; in response to the integrity verification of the transmission file doc being unsuccessful, the 1X client refuses to transmit the file doc′, and requests the first access base station to reissue the communication key QRN-XY and the encryption and decryption key key-XY.

[0022] As an improvement of the present invention, in step 4, the quantum security method adopted by the second access base station is the same as the quantum security method adopted by the first access base station.

[0023] As an improvement of the present invention, in step 5, the generated XY virtual communication network includes the 1X client, the first access base station, the first boundary base station, the second boundary base station, the second access base station, and the 2Y client. The 1X client, the first access base station, the first boundary base station, the second boundary base station, the second access base station, and the 2Y client are communicated and connected in sequence in the generated XY virtual communication network.

[0024] As an improvement of the present invention, the specific process of sequential communication connection is as follows:

[0025] The 1X client accesses the first access base station, and the first access base station is connected to the first boundary base station for communication. Based on the second boundary base station addressed in step 2, the first boundary base station uses the communication key QRN-XY as an index to further address the second access base station that receives the communication key QRN-XY fed back by the second boundary base station, and then based on the second access base station, addresses the 2Y client that receives the communication key QRN-XY issued by the second access base station.

[0026] As an improvement of the present invention, after the XY virtual communication network is constructed and before the 1X client and the 2Y client complete communication, in the XY virtual communication network, the first access base station and the second access base station refuse to establish communication connections with other clients except the 1X client and the 2Y client.

[0027] As an improvement of the present invention, the specific process of refusing to establish a communication connection with other clients except the 1X client and the 2Y client is as follows:

[0028] After the XY virtual communication network is constructed, when other clients try to establish a communication connection with the 1X client through the first access base station, the first access base station refuses; when other clients try to establish a communication connection with the 2Y client through the second access base station, the second access base station refuses; until the 1X client and the 2Y client complete the communication.

[0029] As an improvement of the present invention, the first border base station or the second border base station generates multiple virtual communication networks based on multiple different communication keys, the multiple communication keys correspond one-to-one to the multiple virtual communication networks, and a client only exists in one of the virtual communication networks, and the multiple virtual communication networks perform communication tasks simultaneously.

[0030] Beneficial effects of the present invention:

[0031] Through the method for constructing a virtual communication network based on quantum key association proposed by the present invention, a virtual communication network is constructed based on the same communication key, and the clients of both communicating parties with the same communication key are included in the virtual communication network to perform the communication process, thereby ensuring the normal communication. Third-party clients that do not have the communication key are refused to join the virtual communication network, that is, during the communication process, the filtering of third-party clients by accessing the base station effectively ensures that the clients of both communicating parties are in an isolated state that cannot be connected to the outside world, thereby ensuring the security of the communication process.

[0032] At the same time, while generating the first virtual communication network, the border base station can also generate a second virtual communication network based on the second communication key. As long as the two clients communicating in the first virtual communication network are not involved, the operation of generating multiple virtual communication networks can be carried out simultaneously, thereby improving the efficiency of communication processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 A schematic diagram of a communication network connection;

[0034] Figure 2 A schematic diagram of generating a virtual communication network according to the present invention;

[0035] Figure 3 It is a flowchart of the method for constructing a virtual communication network based on quantum key association of the present invention. DETAILED DESCRIPTION

[0036] The present invention is further described below in conjunction with the accompanying drawings and embodiments.

[0037] As mentioned in the background technology, when the client communicates on the network, it is in a state where the public can connect and access it, which provides information thieves with a channel to invade the client through the network. How to ensure the security of the client in the network environment while ensuring the normal communication of the client is a technical problem that needs to be solved urgently.

[0038] Figure 1A connection diagram of the communication network accessed by the client. Multiple clients access the network through the access base station in the access jurisdiction. The access base station is connected to the boundary base station in the local area network through the local area network, and communicates with other devices in the Internet through the boundary base station. Among them, each of the multiple clients corresponds to a user, which is a terminal device that carries the user's network communication, for example, personal terminal devices such as quantum security privacy computers. The communication between each client needs to be carried out through the access base station and the boundary base station, and direct communication between clients is not possible. The access base station is used to distribute keys to each of the multiple clients connected to the access base station to ensure communication security. The boundary base station is a network communication device used to protect the boundary of the local area network, providing cross-region or cross-local area network key relay and relay routing selection, and realizing network docking for communication. The network here can be a quantum security network or the Internet.

[0039] like Figure 1 As shown, the first client group is connected to the first access base station, the first client group includes multiple clients, denoted as the 1X client (e.g., the 1A, 1B, 1C client, etc.), the first access base station is connected to the first boundary base station, the first access base station and the first boundary base station are connected through a local area network, and the 1A, 1B, 1C clients, etc. access the first access base station through the Internet. The second client group is connected to the second access base station, the second client group includes multiple clients, denoted as the 2Y client (e.g., the 2A, 2B, 2C client, etc.), the second access base station is connected to the second boundary base station, the second access base station and the second boundary base station are connected through a local area network, and the 2A, 2B, 2C clients, etc. access the second access base station through the Internet. The first boundary base station is connected to the second boundary base station through the Internet. The number of the 1A, 1B, 1C clients and the 2A, 2B, 2C clients here is only an example, and more clients can be connected for communication in actual applications.

[0040] In such Figure 1 In the connection diagram of the communication network shown, each client is in an open state to the outside world when communicating. Information thieves can address the client through the IP address of the client to establish a link with the client, thus causing a security threat.

[0041] In view of this, the present application proposes a method for constructing a virtual communication network based on quantum key association.

[0042] like Figure 2As shown, here, the communication between the 1B client and the 2A client that access the communication network via two different access base stations respectively is taken as an example to illustrate the virtual communication network construction method proposed in the present application. The participants of the method include the 1B client in the first client group in the communication network, the first access base station, the first boundary base station, the second boundary base station, the second access base station, and the 2A client in the second client group.

[0043] This method is Figure 3 As shown, the following steps are included.

[0044] Step 1: The 1X client in the first client group initiates a first communication request req1 to the first access base station;

[0045] Specifically, the 1B client initiates a first communication request req1 to the first access base station, and the first communication request req1 includes the IP address information of the second border base station to which the communicating opposite-end client accesses and the IP address of the communicating opposite-end client, as well as information indicating that the first access base station issues a communication key (referred to as the first communication key) and an encryption and decryption key (referred to as the first encryption and decryption key) for this communication to the 1B client. The first communication key is used to associate the two clients participating in this communication, and the first encryption and decryption key is used to perform encryption and decryption operations on the communication content.

[0046] Step 2: The first access base station generates a second communication request req2 based on the first communication request req1, and sends the second communication request req2 to the first border base station, and the first border base station addresses the second border base station according to the second communication request req2;

[0047] Specifically, the first access base station generates a second communication request req2 based on the received first communication request req1, and sends the second communication request req2 to the first border base station. The second communication request req2 instructs the first border base station to address the second border base station based on the IP address information of the second border base station, wherein the second border base station is connected to the second access base station connected to the 2A client.

[0048] Step 3: The first border base station negotiates a key with the second border base station, and determines that the communication key in this communication process is QRN-XY, and the encryption and decryption key is key-XY;

[0049] Specifically, the first border base station negotiates keys with the addressed second border base station, and determines that the first communication key in this communication process is QRN-BA, and the first encryption and decryption key is key-BA. It should be noted that the encryption method used in this application is one-time one-key, and the communication key and encryption and decryption key in each communication process are different from the communication key and encryption and decryption key in other communication processes. However, the communication key and encryption and decryption key of the communication process can be the same, for example, both are 1110001.

[0050] Step 4: The first border base station feeds back the communication key QRN-XY and the encryption and decryption key key-XY to the first access base station, and the first access base station issues the communication key QRN-XY and the encryption and decryption key key-XY to the 1Xth client in a quantum secure manner; at the same time, the second border base station feeds back the communication key QRN-XY and the encryption and decryption key key-XY to the second access base station, and the second access base station issues the communication key QRN-XY and the encryption and decryption key key-XY to the 2Yth client in the second client group in a quantum secure manner;

[0051] Specifically, the first border base station feeds back the first communication key QRN-BA and the first encryption and decryption key key-BA to the first access base station, and the first access base station issues the first communication key QRN-BA and the first encryption and decryption key key-BA to the 1B client in a quantum secure manner; at the same time, the second border base station feeds back the first communication key QRN-BA and the first encryption and decryption key key-BA to the second access base station, and the second access base station issues the first communication key QRN-BA and the first encryption and decryption key key-BA to the 2A client in a quantum secure manner.

[0052] Since the first border base station and the first access base station, and the second border base station and the second access base station are connected through a local area network, and no external network device can directly access the local area network, the transmission of the first communication key QRN-BA and the first encryption and decryption key key-BA between the border base station and the access base station can be considered safe.

[0053] Here, when the first access base station issues the first communication key QRN-BA and the first encryption and decryption key key-BA to the 1B client in a quantum secure manner, the quantum secure manner may be as follows:

[0054] 4-1: The first access base station concatenates the first communication key QRN-BA and the first encryption and decryption key key-BA into a transmission file doc=(QRN-BA, key-BA). Before the communication process begins, the first access base station and each connected client agree in advance that the first field of the transmission file is the communication key and the second field is the encryption and decryption key.

[0055] 4-2: The first access base station obtains a set of keys u1 from the local key pool as random numbers to generate an irreducible polynomial p1(x). After obtaining the irreducible polynomial, the character string consisting of the coefficients of each term except the highest term in the irreducible polynomial p1(x) is recorded as str1.

[0056] 4-3: The first access base station negotiates a set of keys (u2, u3) with the 1B client, and generates a hash function h based on the irreducible polynomial p1(x) and the key u2 p1,u2 , use this hash function to calculate the first hash value h of the transferred file doc p1,u2 (doc), encrypt the first hash value h using key u3 p1,u2 (doc), transfer file doc, and string str1, encrypt and select XOR operation, and get the first ciphertext m=[h p1,u2 (doc),doc,str1]⊕u3.

[0057] 4-4: The first access base station sends the first ciphertext m to the 1B client, and the 1B client verifies the integrity of the received transmission file doc.

[0058] Specifically, the 1B client uses the negotiated key u3 to perform a decryption operation and obtains the decrypted second hash value h′ p1,u2 (doc), transmission file doc′, and string str1′, use the coefficients of each polynomial except the highest term of each bit of the decrypted string str1′ to generate an irreducible polynomial p′1(x) with the highest term coefficient as 1, and generate a hash function h″ based on the irreducible polynomial p′1(x) and the negotiated key u2 p1,u2 , using this hash function to calculate the third hash value h″ of the transmission file doc′ p1,u2 (doc′). Compare the third hash value h″ p1,u2 (doc′) and the second hash value h′ p1,u2 (doc) are consistent? If they are consistent, the integrity verification passes. If they are inconsistent, the integrity verification fails.

[0059] 4-5: In response to the integrity verification of the transmission file doc passing, the 1B client accepts the transmission file doc′, and parses the transmission file doc′ to obtain the first communication key QRN-BA and the first encryption and decryption key key-BA; wherein the parsing process is to split the transmission file doc′ and restore the first communication key QRN-BA and the first encryption and decryption key key-BA. In response to the failure of the integrity verification of the transmission file doc, it means that the transmission file doc has been tampered with during the transmission process, and the decrypted transmission file doc′ is different from the transmission file doc when sent by the first access base station. Therefore, the 1B client refuses to transmit the file doc′, and requests the first access base station to reissue the first communication key QRN-BA and the first encryption and decryption key key-BA. Accordingly, the second access base station also needs to reissue the first communication key QRN-BA and the first encryption and decryption key key-BA to the 2A client.

[0060] Similarly, when the second access base station issues the first communication key QRN-BA and the first encryption and decryption key key-BA to the 2A client in a quantum secure manner, the quantum secure manner may also be the above-mentioned manner, which will not be repeated here.

[0061] Only when client 1B and client 2A accept the first communication key QRN-BA and the first encryption and decryption key key-BA at the same time, the process of issuing the communication key and encryption and decryption key is completed. Otherwise, as long as one party does not accept it, the communication key and encryption and decryption key will need to be reissued to client 1B and client 2A.

[0062] Step 5: The first border base station generates a XYth virtual communication network based on the communication key QRN-XY based on the second communication request req2 and the communication key QRN-XY;

[0063] Specifically, the first border base station generates a BAth virtual communication network based on the first communication key QRN-BA based on the second communication request req2 and the first communication key QRN-BA, and incorporates the first access base station, the 1B client, and the addressed second border base station, the second access base station, and the 2A client into the BAth virtual communication network; in the BAth virtual communication network, the 1B client, the first access base station, the first border base station, the second border base station, the second access base station, and the 2A client are communicated and connected in sequence.

[0064] Specifically, based on the second border base station addressed above, the first border base station uses the first communication key QRN-BA as an index to further address the second access base station that has received the first communication key QRN-BA sent by the second border base station, and then based on the second access base station, addresses the 2A client that has received the first communication key QRN-BA issued by the second access base station.

[0065] It should be noted that after the first boundary base station completes the construction of the BA virtual communication network, the first access base station and the second access base station implement the operation of preventing other clients from entering the BA virtual communication network, thereby refusing third parties other than the 1B client and the 2A client to insert into the communication process.

[0066] Specifically, after the BA virtual communication network is built, when the third client attempts to establish a communication connection with the 1B client through the first access base station, the first access base station rejects it; when the third client attempts to establish a communication connection with the 2A client through the second access base station, the second access base station rejects it. This rejection process continues until the 1B client completes the communication with the 2A client. That is, after the virtual communication network is built, the 1B client and the 2A client are in an isolated state that cannot be connected to the outside world, effectively rejecting the connection of the third party, thus ensuring the security of this communication process.

[0067] Step 6: In the XY virtual communication network, the 1X client uses the encryption and decryption key key-XY to encrypt the communication content and communicate with the 2Y client. After the communication is completed, the first border base station releases the XY virtual communication network.

[0068] Specifically, the 1B client uses the encryption and decryption key key-BA to encrypt the communication content, and communicates with the 2A client on the encrypted communication content to achieve confidentiality and security of the communication. After the communication is completed, the first boundary base station releases the BA virtual communication network, allowing the 1B client and the 2A client to return to the Internet to perform the next communication service with other clients.

[0069] At this time, the first access base station allows the new client to establish a communication connection with the 1B client, and the second access base station allows the new client to establish a communication connection with the 2A client.

[0070] Similarly, if Figure 2As shown, when the first border base station detects that there are other clients (for example, the 1C client and the 2C client) other than the 1B client and the 2A client for communication, the above steps 1-5 can be performed synchronously, and the first border base station generates the CC virtual communication network based on the communication request and the second communication key QRN-CC. The BA virtual communication network and the CC virtual network do not affect each other, and communication tasks can be performed at the same time to improve communication processing efficiency. In other words, the first border base station or the second border base station can generate multiple virtual communication networks based on different multiple communication keys, and the multiple communication keys correspond one-to-one to the multiple virtual communication networks, and a client only exists in one of the virtual communication networks. For example, when the 1B client is in the BA virtual communication network and is performing a communication process, it cannot exist in other virtual communication networks at the same time to perform other communication processes. Multiple virtual communication networks can exist at the same time and perform communication tasks at the same time.

[0071] In some embodiments, in order to save the amount of keys, the communication key and the encryption / decryption key may be the same key, for example, both are 1110001.

[0072] Through the above operation of generating a virtual communication network, two clients with the same communication key are separated for encrypted communication. After the virtual communication network is built, the first access base station and the second access base station both deny other clients access to the virtual communication network. At this time, the 1B client and the 2A client are in an isolated state that cannot be connected to the outside world, effectively denying the connection of a third party, thus ensuring the security of the communication process.

Claims

1. A method for constructing a virtual communication network based on quantum key association, characterized in that: The participants of the method include a first client group, a first access base station, a first boundary base station in a communication network, and a second client group, a second boundary base station, and a second access base station to be communicated with the first client group, wherein the number of clients in the first client group and the second client group is at least one, the clients in the first client group are all connected to the first access base station, the first access base station is connected to the first boundary base station for communication, and the clients in the second client group are all connected to the second access base station, and the second access base station is connected to the second boundary base station for communication; the method includes the following steps: Step 1: The 1X client in the first client group initiates a first communication request req1 to the first access base station; Step 2: The first access base station generates a second communication request req2 based on the first communication request req1, and sends the second communication request req2 to the first border base station, and the first border base station addresses the second border base station according to the second communication request req2; Step 3: The first border base station negotiates a key with the second border base station, and determines that the communication key in this communication process is QRN-XY, and the encryption and decryption key is key-XY; Step 4: The first border base station feeds back the communication key QRN-XY and the encryption and decryption key key-XY to the first access base station, and the first access base station issues the communication key QRN-XY and the encryption and decryption key key-XY to the 1Xth client in a quantum secure manner; at the same time, the second border base station feeds back the communication key QRN-XY and the encryption and decryption key key-XY to the second access base station, and the second access base station issues the communication key QRN-XY and the encryption and decryption key key-XY to the 2Yth client in the second client group in a quantum secure manner; Step 5: The first border base station generates a XYth virtual communication network based on the communication key QRN-XY based on the second communication request req2 and the communication key QRN-XY; Step 6: In the XY virtual communication network, the 1X client uses the encryption and decryption key key-XY to encrypt the communication content and communicate with the 2Y client. After the communication is completed, the first border base station releases the XY virtual communication network.

2. The method for constructing a virtual communication network based on quantum key association according to claim 1, characterized in that: In the step 1, the first communication request req1 includes the IP address information of the second border base station to which the client to be communicated with the 1X client is connected and the IP address information of the client to be communicated with the 1X client, and also includes information instructing the first access base station to issue a communication key and an encryption and decryption key to the 1X client; wherein the client to be communicated with the 1X client is the 2Y client in the second client group; the communication key is used to associate the 1X client and the 2Y client participating in this communication, and the encryption and decryption key is used to perform encryption and decryption operations on the communication content.

3. The method for constructing a virtual communication network based on quantum key association according to claim 1, characterized in that: In the step 2, the second communication request req2 includes information instructing the first border base station to address the second border base station based on the IP address information of the second border base station.

4. The method for constructing a virtual communication network based on quantum key association according to claim 2, characterized in that: In step 4, the quantum security method used by the first access base station to issue the communication key QRN-XY and the encryption and decryption key key-XY to the 1X client is as follows: 4-1: The first access base station concatenates the communication key QRN-XY and the encryption and decryption key key-XY into a transmission file doc=(QRN-XY, key-XY); 4-2: The first access base station obtains a set of keys u1 from the local key pool as random numbers, which are used to generate an irreducible polynomial p1(x). After obtaining the irreducible polynomial, the character string consisting of the coefficients of each term except the highest term in the irreducible polynomial p1(x) is recorded as str1; 4-3: The first access base station negotiates a set of keys (u2, u3) with the 1X client, and generates a hash function h based on the irreducible polynomial p1(x) and the key u2 p1,u2 , using the hash function h p1,u2 Calculate the first hash value h of the transferred file doc p1,u2 (doc), encrypt the first hash value h using key u3 p1,u2 (doc), transfer file doc, and string str1, get the first ciphertext m=[h p1,u2 (doc),doc,str1]⊕u3; 4-4: The first access base station sends the first ciphertext m to the 1X client, and the 1X client verifies the integrity of the received transmission file doc: The 1X client uses the negotiated key u3 to perform a decryption operation and obtains the decrypted second hash value h′ p1,u2 (doc), transmission file doc′, and string str1′, use the coefficients of each item of the polynomial except the highest item of each bit of the decrypted string str1′ to generate an irreducible polynomial p′1(x) with the highest item coefficient as 1, and generate a hash function h″ based on the irreducible polynomial p′1(x) and the negotiated key u2 p1,u2 , using the hash function h″ p1,u2 Calculate the third hash value h″ of the transmission file doc′ p1,u2 (doc′); compare the third hash value h″ p1,u2 (doc′) and the second hash value h′ p1,u2 (doc) Whether it is consistent, if it is consistent, the integrity verification passes, if it is inconsistent, the integrity verification fails; 4-5: In response to the integrity verification of the transmission file doc being successful, the 1X client accepts the transmission file doc′, and parses the transmission file doc′ to obtain the communication key QRN-XY and the encryption and decryption key key-XY; in response to the integrity verification of the transmission file doc being unsuccessful, the 1X client refuses to transmit the file doc′, and requests the first access base station to reissue the communication key QRN-XY and the encryption and decryption key key-XY.

5. The method for constructing a virtual communication network based on quantum key association according to claim 4, characterized in that: In step 4, the quantum security method adopted by the second access base station is the same as the quantum security method adopted by the first access base station.

6. The method for constructing a virtual communication network based on quantum key association according to claim 1, characterized in that: In step 5, the generated XY virtual communication network includes the 1X client, the first access base station, the first boundary base station, the second boundary base station, the second access base station, and the 2Y client. The 1X client, the first access base station, the first boundary base station, the second boundary base station, the second access base station, and the 2Y client are communicated and connected in sequence in the generated XY virtual communication network.

7. The method for constructing a virtual communication network based on quantum key association according to claim 6, characterized in that: The specific process of sequential communication connection is as follows: The 1X client accesses the first access base station, and the first access base station is connected to the first boundary base station for communication. Based on the second boundary base station addressed in step 2, the first boundary base station uses the communication key QRN-XY as an index to further address the second access base station that receives the communication key QRN-XY fed back by the second boundary base station, and then based on the second access base station, addresses the 2Y client that receives the communication key QRN-XY issued by the second access base station.

8. The method for constructing a virtual communication network based on quantum key association according to claim 1, characterized in that: After the XYth virtual communication network is constructed and before the 1Xth client and the 2Yth client complete communication, in the XYth virtual communication network, the first access base station and the second access base station refuse to establish communication connections with other clients except the 1Xth client and the 2Y client.

9. The method for constructing a virtual communication network based on quantum key association according to claim 8, characterized in that: The specific process of refusing to establish communication connection with other clients except the 1X client and the 2Y client is as follows: After the XY virtual communication network is constructed, when other clients try to establish a communication connection with the 1X client through the first access base station, the first access base station refuses; when other clients try to establish a communication connection with the 2Y client through the second access base station, the second access base station refuses; until the 1X client and the 2Y client complete the communication.

10. The method for constructing a virtual communication network based on quantum key association according to claim 1, characterized in that: The first border base station or the second border base station generates multiple virtual communication networks based on multiple different communication keys, the multiple communication keys correspond one-to-one to the multiple virtual communication networks, and a client only exists in one of the virtual communication networks, and the multiple virtual communication networks perform communication tasks simultaneously.

Images